CVE-2024-2088 is a sensitive information exposure vulnerability in the NextScripts: Social Networks Auto-Poster WordPress plugin, affecting all versions up to 4.4.3. The flaw exists in the 'nxs_getExpSettings' function, which improperly exposes sensitive data such as API keys and secrets to authenticated users with subscriber privileges or higher. This vulnerability has a CVSS 3.1 base score of 8.5, reflecting network attack vector, low attack complexity, required privileges at the level of a subscriber, no user interaction, and high confidentiality impact with limited integrity impact and no availability impact. No known exploits in the wild have been reported, and no patch or official fix has been documented.

Authenticated users with subscriber-level access or above can retrieve sensitive configuration data including social network API keys and secrets. This exposure could allow attackers to misuse these credentials to interact with social network APIs, potentially leading to unauthorized actions or data leakage. The integrity and availability impacts are limited, but confidentiality is highly impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access to trusted users only and monitor for suspicious activity related to social network API usage. Avoid granting unnecessary privileges to users and consider disabling or replacing the plugin if sensitive data exposure risk is unacceptable.